Round 2: The CA AG Proposes Additional Changes to CCPA Regulations
By Justine Gottshall and Tatyana Ruderman
On Wednesday, the California Attorney General published its second round of modifications to its proposed regulations for the California Consumer Privacy Act. We reviewed some key updates from the first round of modifications to the AG’s proposed regulations in our post on February 13, 2020 . Below we review some of the key updates, noting that the AG mostly made typographical edits and clarifications, and changes to its last round of edits to eliminate confusion. The AG is accepting written comments on the proposed changes until Friday, March 27, 2020 at 5:00pm.
Quick Highlights
Deletes an explanatory paragraph (added in the prior round of amendments) regarding when information, such as IP address might not be “personal information.”
Key Takeaway: While the original paragraph was not entirely clear, it is less clear what the AG is trying to communicate with the deletion at this point. Many companies continue to struggle with the practical implications of the broad definition of “personal information” set forth in the CCPA and there is, unfortunately, little added by this latest round of revisions to the Regs.
Eliminates Template Design for Opt-Out Button: The second modifications removed the confusing template opt-out button.
Key Takeaway: Note that the CCPA charges the AG with “the development and use of a recognizable and uniform opt-out logo or button by all businesses to promote consumer awareness of the opportunity to opt-out of the sale of personal information.” Thus, we should expect another attempt at this from the AG.
Adds Disclosures if Withholding Certain Specific Pieces of Information: As previously noted, the AG includes a list of types of info that should never be disclosed, most recently “biometric data.” The AG now adds that when responding to a request for specific pieces of information, a business still needs to tell the consumer that it has generally collected that type of information (but not provide the specific data).
Key Takeaway: Companies will want to update their template consumer responses to account for this change.
Tweaks Definitions of “Financial Incentive” and “Price or Service Difference: The key change is that the regulations now state that a program qualifies if it is “related to” rather than “as compensation for” the “disclosure, deletion, or sale of personal information.”
Key Takeaway: This is a significant broadening of “financial incentive” and companies should consider carefully how it may impact existing marketing programs if this remains in the final Regs.
Scales Back Restrictions on CCPA Records: The AG added an exception to its restriction that “information maintained for recordkeeping purposes shall not be shared with any third party,” providing that it may be shared “as necessary to comply with a legal obligation.”
Key Takeaway: This was a necessary addition, although it would be more helpful to include as well legal and financial advisors under confidentiality agreements.
Although there remains the potential for additional changes to the AG Regulations, there is limited time left before the July 1 enforcement date and companies will need to come into as much compliance as possible with the Regs as the currently stand. And stay tuned . . .